Even identical twins have their differences

Our digital world is constantly expanding, with more and more people and businesses becoming interconnected every day. More than 4.6 billion consumers around the world now shop online, for example. In the EU, one in two citizens uses the Internet to interact with public authorities. Following the introduction of biometric passports, many countries are now enabling their citizens to transfer their ID cards and driver’s licenses to their smartphones. That makes it possible for border controls, traffic checks, and legally binding transactions to be conducted on cell phones. “If you add up all these activities and many others that are performed on the Internet, each person probably has an average of several dozen digital identities,” says Xavier Prost, Head of Product Management at Veridos.

But what exactly is a digital identity? The term refers to the electronic data that depicts a person, an organization, an application, or a device in a uniquely identifiable way. “A digital identity is the set of digital attributes that represent someone or something. When it comes to online activities, it’s vital that people can be uniquely identified as who they say they are – i.e. when they enter into a sales contract online and then transfer money from their bank account or when they log into a company network from a laptop at home,” adds Xavier Prost. Identity fraud has become a billion-dollar industry. Illegal activities in this sector range from the unauthorized use of real identities (e.g. shopping at the expense of others) through the selling of entire customer databases (e.g. for phishing e-mails) to the creation of synthetic, completely fake identities. These activities always involve scammers gaining access to information or data that they otherwise would not have had. In the US, for example, synthetic identity fraud is the fastest growing form of financial fraud.

Giesecke+Devrient is actively helping to reduce identity fraud. Our joint venture with Bundesdruckerei – Veridos GmbH – develops and produces physical and digital identity solutions for customers around the world and ensures their lifecycle management processes are secure. We have a broad product portfolio, with our plant in Athens producing government documents – 45,000 passports and 30,000 ID cards every day – as well as driver’s licenses, visas, and many other items. We also supply customers with access and border control systems (e.g. automated security gates for airports). Also in great demand are e-government solutions, which have proven to be particularly valuable, or indeed indispensable, during the Covid-19 pandemic. Now that government authorities all over the world are closed to the public and not providing face-to-face services, how can people obtain official documents they urgently need, such as vaccination certificates, curfew exemptions, and permits to visit care homes? With the VeriGO® TrueSeal e-government solution, stakeholders use a web portal to issue documents featuring a digital seal of authenticity and a unique number. When this seal is presented together with a physical or digital identity document or driver’s license, the owner of the document can prove its authenticity uniquely and securely. VeriGO® TrueSeal thus enables secure, convenient, and privacy-friendly digital verification of sensitive documents, such as those required during the Covid-19 pandemic.

Trends in wider society inevitably have implications for secure identity verification, not least because our smartphones are rapidly becoming the hub of our daily lives. We already use them to communicate, browse the Internet, search for information, and pay for purchases. “It therefore makes sense for us to be able to use our smartphones to identify and authenticate ourselves securely – for example, to virtually open a bank account, rent a car, or deal with public authorities,” emphasizes Michael Tagscherer, Corporate Technology Officer at G+D. It’s likely that we’ll be able to do all these things by the end of 2021: G+D, Bundesdruckerei, and Vodafone are aiming to bring the online ID card function of personal identity cards to smartphones. “In the future, ID card data will be stored and managed on the highly secure chip of the embedded SIM through G+D's eSIM management. Eventually, this will be supported by a large number of smartphones.”

The basis for this kind of official and monetary functionality on smartphones – other examples include car sharing and valuable frequent user tickets for public transportation systems – is the OPTIMOS 2.0 platform for secure identities. Working with many major industrial enterprises and research institutes, G+D has developed an open security architecture and a platform for data and application management in a project that received funding from the German Federal Ministry for Economic Affairs and Energy (BMWi). The concept is simple: a Trusted Service Management (TSM) creates a secure communication channel between a service provider and a customer’s smartphone. Sensitive customer data is stored securely on an eSIM card or the ESE (embedded Secure Element). “The data is cryptographically protected against attacks and manipulation, but it can be easily made available for authorized services and applications when required,” explains Tagscherer.

If a person wants to check someone’s identity without using any technical aids, they often rely on their own eyes. This works well up to a point, but there are limits. It’s tricky for the human eye to tell identical twins apart, for example, since even parents sometimes struggle. However, despite having nearly identical DNA, identical twins do differ when it comes to external features, such as fingerprints, facial lines, birthmarks, and iris structure. People can recognize these and other subtle differences, but machines are increasingly being used as well to support visual identity verification. Sophisticated machines equipped with algorithm technology can spot even the tiniest differences and are well on the way to becoming as good as humans. In addition, they are more financially efficient and don’t get tired or distracted even when deployed 24/7. That can make a crucial difference, for example in presentation attack detection (PDA). When John Doe uses biometric authentication on his home PC to identify himself to a public authority, e.g. in order to renew his entitlement to state payments or apply for a police certificate, a PDA app can detect whether John’s real face is looking at the camera or an unauthorized person is using a photo or video of him. When used in conjunction with other credentials, such as a PIN or a token, the identity verification process is highly reliable.

Border control points are another area where machines have been carrying out vital services for some time and are having to cope with an increasing workload. According to the International Air Transport Association (IATA), airport passenger numbers around the world are likely to return to pre-Covid levels by 2024. The customary border officials will increasingly be supported by e-gates. G+D has already installed and commissioned more than 400 such automated border control systems worldwide. They enable airports and border control to handle more passengers with the existing staffing levels.

Sometimes, however, identity recognition is explicitly not wanted, e.g. when the video cameras installed in autonomous vehicles capture the license plates of other road users. Our investment in Brighter AI Technologies GmbH has enabled us to expand the G+D portfolio to include a solution that uses AI techniques to remove this type of data from the camera footage. This protects the privacy of citizens while giving OEMs significantly more opportunities to improve their data-driven systems.

Published: 31/03/2021